HIPAA - Health Insurance Portability and Accountability Act Protected Health Information (PHI) Questions and Answers

Question 1

Which of the following data elements, when combined with a patient's medical condition, would NOT be considered Protected Health Information (PHI) under HIPAA?

Accepted Answer

The initial three digits of a zip code for a geographic area containing 25,000 people

Answer

According to the HIPAA Safe Harbor method for de-identification, the initial three digits of a zip code are not considered a direct identifier if the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people. The other options—full face photograph, year of birth (for those under 90), and medical record number—are all explicitly listed as identifiers that constitute PHI.

Question 2

A hospital billing department outsources its coding to a third-party company. The coding company requires access to patient charts to perform its function. Under HIPAA, what is the most critical step the hospital must take before granting this access?

Accepted Answer

Execute a Business Associate Agreement (BAA) with the coding company.

Answer

When a covered entity (the hospital) hires a person or entity (the coding company) to perform functions involving the use or disclosure of PHI, that entity is considered a Business Associate. HIPAA requires a formal, written Business Associate Agreement (BAA) to be in place before any PHI is shared. This contract legally requires the business associate to maintain the same level of protection for the PHI as the covered entity.

Question 3

A nurse is discussing a patient's care with a doctor in a semi-private room. A patient in the next bed, separated by a curtain, overhears the doctor mention the first patient's name and diagnosis. Assuming the conversation was conducted in a low voice and was necessary for treatment, how would this situation be classified under HIPAA?

Accepted Answer

An incidental disclosure.

Answer

This scenario describes an incidental disclosure. An incidental disclosure is a secondary, unavoidable exposure of PHI that occurs as a byproduct of an otherwise permissible activity (like a treatment discussion). It is not a violation, provided that reasonable safeguards (speaking in low voices) were in place and the minimum necessary information was shared for the primary purpose of treatment.

Question 4

According to the HIPAA Privacy Rule's 'Minimum Necessary' standard, a covered entity must make reasonable efforts to limit the use and disclosure of PHI. In which of the following scenarios does the Minimum Necessary standard NOT apply?

Accepted Answer

A disclosure from one healthcare provider to another for treatment purposes.

Answer

The HIPAA Privacy Rule explicitly exempts disclosures of PHI for treatment purposes between healthcare providers from the Minimum Necessary standard. This allows providers to freely share information necessary to provide quality care. However, the Minimum Necessary standard does apply to disclosures for payment and healthcare operations, such as billing or quality assessment.

Question 5

A patient discovers an error in their medical record and submits a formal written request to their provider to have it corrected. Under the HIPAA Privacy Rule, what right is the patient exercising?

Accepted Answer

The Right to Amend PHI

Answer

The HIPAA Privacy Rule provides patients with the right to request an amendment of their PHI in a designated record set if they believe the information is inaccurate or incomplete. The covered entity must then review the request and either make the amendment or provide a written denial to the patient.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Protected Health Information (PHI) Questions and Answers